Legal
Sub-processors
Last updated: June 17, 2026
Overview
ENZROSSI SOFTWARE SOLUTIONS LTDA. (CNPJ 54.763.387/0001-67), operator of the Vetted talent platform, uses the third-party providers listed below to deliver the service. Each provider processes personal data only on our instructions, under a written data processing agreement, and only for the purpose described here. This list is the source of truth referenced in Section 7 (Data Shared with Third Parties) of our Privacy Policy.
We update this page whenever we add, remove, or replace a sub-processor. The "Last updated" date above changes on every revision. If you want a notification when sub-processors change, email privacidade@enzrossi.com.
Active sub-processors
| Provider | Purpose | Region | Transfer mechanism |
|---|---|---|---|
| Supabase, Inc. | Managed Postgres database, authentication, and private file storage (CVs, intro videos, per-question videos, profile pictures). | EU or US, depending on project region | EU SCCs; LGPD Art. 33, IX |
| Vercel, Inc. | Application hosting, server-side rendering, edge delivery, and access logs for the Platform. | Global edge with primary US storage | EU SCCs and Vercel DPA; LGPD Art. 33, IX |
| Anthropic, PBC | AI services for CV parsing, position-gap question generation, and match recommendation drafting. Zero-retention API tier; no training on your data. | United States | EU SCCs and Anthropic DPA; LGPD Art. 33, IX |
| Resend, Inc. | Transactional email delivery (account, application status, reminders, interview invites, breach notifications). | United States | EU SCCs and Resend DPA; LGPD Art. 33, IX |
| Google LLC | Google Calendar and Google Meet for interview scheduling. We only access the calendar of the interviewer who connected their Google account; we do not read candidate calendars. | United States and Google global infrastructure | EU SCCs under Google Workspace DPA; LGPD Art. 33, IX |
| Google LLC — Analytics 4 & Search Console | Aggregated product analytics (page views, navigation, conversions) and search-performance reporting on our public pages. Analytics scripts load only after you accept analytics cookies; IP anonymisation is enabled. Search Console reads our public content and does not set cookies on your browser. | United States and Google global infrastructure | EU SCCs under Google's Measurement Controller-Controller terms; LGPD Art. 33, IX |
| Functional Software, Inc. (Sentry) | Crash, error, and performance reporting (always on, legitimate interest, no cookies) and Session Replay (loaded only after you accept analytics cookies). Session Replay masks all input fields by default. | United States | EU SCCs and Sentry DPA; LGPD Art. 33, IX |
| ipapi.is | IP geolocation and VPN / proxy / Tor detection at application submission (primary provider), so we can verify the stated country and flag applications for human review. We store the result and a hashed IP, never the raw IP. | United States | EU SCCs and ipapi.is DPA; LGPD Art. 33, IX |
| proxycheck.io | IP geolocation and VPN / proxy / Tor detection at application submission (fallback when the primary provider is unavailable). We store the result and a hashed IP, never the raw IP. | United States | EU SCCs and proxycheck.io DPA; LGPD Art. 33, IX |
Onward sub-processors
Each provider above operates its own infrastructure stack and may rely on additional sub-processors (for example, cloud hosting, DNS, or content delivery providers). Those onward sub-processors are bound by the same data-protection terms our provider has agreed to with us. You can review their lists directly at the links below.
Supabase privacy and sub-processors • Vercel privacy • Anthropic privacy • Resend privacy • Google privacy • Sentry privacy • ipapi.is privacy • proxycheck.io privacy
Questions or objections
If you object to a specific sub-processor handling your data, email our Data Protection Officer at privacidade@enzrossi.com. We will explain the role the provider plays, the safeguards in place, and any alternatives we can offer. Where we cannot accommodate your objection without breaking core functionality of the Platform, we will let you know so you can decide whether to continue using the service.